Method of detecting a reference sequence of events in a sample sequence of events

ABSTRACT

A method of detecting a reference sequence of events in a sample sequence of events, wherein each event is of a certain event type and holds a set of data attributes, includes the steps of: picking candidate combinations of events from said sample sequence so that the event types within each candidate combination match the event types in the reference sequence, calculating an overall similarity score for each candidate combination from at least (i) an event occurrence score based on occurrence deviations of the events of a candidate combination with respect to the matching events of the reference sequence and (ii) an attribute match score based on similarity deviations between the data attributes of the events of a candidate combination and the data attributes of the matching events of the reference sequence, and identifying the candidate combination with the best overall similarity score as reference sequence detected.

FIELD OF THE INVENTION

The present invention relates to a method of detecting a referencesequence of events in a sample sequence of events, wherein each event isof a certain event type and holds a set of data attributes.

TECHNICAL BACKGROUND

Event-based systems and particularly the concept of Complex EventProcessing (CEP) have been developed and used to control businessprocesses with loosely coupled systems. CEP enables monitoring, steeringand optimizing business processes with minimal latency. It facilitatesautomated, near real-time closed-loop decision making at an operationallevel to discover exceptional situations or business opportunities.Typical application areas are financial market analysis, trading,security, fraud detection, logistics like tracking shipments, compliancechecks, and customer relationship management.

In an event-based system, any notable state change in the businessenvironment is captured in the form of an event. Events are datacapsules holding data about the context of the state change in so calledevent attributes. Chains of semantically or temporally correlated eventsreflect complete business processes, sequences of customer interactionsor any other sequence of related incidents.

For the analysis of historical event data, but also for an operationalevent-based system, one question is of particular interest: Having anevent sequence on hand, which other sequences are similar to thissequence? For data analysis, answering this question helps for searchingthe historic data for incidents and event patterns similar to a knownreference pattern. In the operational system, the discovery ofsimilarities can be integrated into the decision processes for automatedsystem decisions to react in near real-time to certain event pattern. Inaddition, it can be used for forecasting of events or process measuresbased on similar historic incidents.

Current approaches towards similarity searching in event sequences arelimited in various ways. Time-series similarity allows for discovery ofsimilarities in numeric value sequences. Yet, inhomogeneous event data,consisting of attributes of arbitrary data types can only partially beprocessed, and a discovery of matching sub-sequences is not possible. Inaddition, no flexibility in modelling and constraining the comparisonprocess is given and comparison of attributes is limited.

Accordingly, there is a need to provide an improved method for detectingreference sequences in arbitrary sample sequence which allows for theprocessing of inhomogeneous event data, the detection of sub-sequences,and/or flexibility in modelling and constraining the detection processwith consistent and reliable results.

SUMMARY OF THE INVENTION

It is an object of the invention to fulfill these and other needs, toovercome problems associated with the prior art, and to provide asimilarity comparison model which overcomes above named shortcomings andconsiders all relevant aspects of event sequences for the comparisonprocess. It is a further object of the invention to propose a methodthat offers utmost flexibility in configuration and customization of thematching process.

To this end, the invention provides a method of detecting a referencesequence of events in a sample sequence of events, wherein each event isof a certain event type and holds a set of data attributes, comprisingthe steps of:

(a) picking candidate combinations of events from said sample sequenceso that the event types within each candidate combination match theevent types in the reference sequence,

(b) calculating an overall similarity score for each candidatecombination from at least

-   -   (i) an event occurrence score based on occurrence deviations of        the events of a candidate combination with respect to the        matching events of the reference sequence and    -   (ii) an attribute match score based on similarity deviations        between the data attributes of the events of a candidate        combination and the data attributes of the matching events of        the reference sequence, and

(c) identifying the candidate combination with the best overallsimilarity score as reference sequence detected.

In preferred embodiments the method of the invention comprises thecorrelation of the events in the event sequence, the application of aset of similarity techniques for matching the event sequence against thereference sequence and the calculation of a similarity score byweighting and accumulating the results of all applied techniques. Inaddition, the invention proposes techniques for modelling andconstraining the reference sequence to improve and precise similaritydiscovery.

Preferred scoring techniques included in the method are: A technique forevent type matching to discover occurrences of event types in thesequence, either in the sense of full sequence matching or sub-sequencesearching, a technique for discovering similarities in event occurrencetimes, several techniques for comparing event attributes of various datatypes, techniques for modelling constraints in the reference sequenceincluding event occurrence constraints, event attribute constraints andinsertion of arbitrary events, occurrence time ordering constraints anda technique to weight all of the previous techniques' results.

In particular, preferred embodiments of the method comprise calculatingthe overall similarity score as a weighted sum of at least the eventoccurrence score and the attribute match score; and/or calculating theevent occurrence score from the counts of events lying in the samplesequence between each two events which have been picked into saidcandidate combination; and/or calculating the event occurrence scorefrom deviations of the actual occurrence times of the events of acandidate combination with respect to expected occurrence times definedin the reference sequence.

Preferably, in order to safe calculation time, the step of calculatingthe overall similarity score for a specific candidate combination can beterminated when the overall similarity score passes a given thresholdduring said calculating; and/or attribute match scores can be determinedonly for those candidate combinations for which the event occurrencescores do not pass a given threshold during the determining of the eventoccurrence scores.

A further particularly preferred embodiment of the invention comprisesthe use of a tree graph in calculating the overall similarity scores forthe individual candidate combinations. To this end, the events pickedfrom the sample sequence are put as nodes into a tree graph, eachcandidate combination forming a branch of the tree graph consisting ofnodes connected via edges, wherein occurrence deviations are attributedas weights to said edges and similarity deviations as weights to saidnodes, and wherein the overall similarity score of a candidatecombination is calculated as the total weight accumulated along thebranch formed by that candidate combination. Here, the saving ofcalculation time can be easily implemented by not pursuing thecalculation of the overall similarity score for a specific candidatecombination further when said overall similarity score passes a giventhreshold; and/or by determining similarity deviations only for thosecandidate combinations for which occurrence deviation weights do notexceed a given threshold.

In all embodiments of the invention, constraints can be introduced intothe matching steps. Preferably the reference sequence comprises timeconstraints, and said overall similarity score is calculatedadditionally from

-   -   (iii) a time constraint violation score based on time constraint        violations of the events of a candidate combination with respect        to said time constraints; and/or    -   the reference sequence comprises arrangement constraints, and        said overall similarity score is calculated additionally from    -   (iv) an arrangement constraint violation score based on        arrangement constraint violations due to the order of events in        a candidate combination with respect to said arrangement        constraint; and/or    -   event count constraints are set in the reference sequence, and        said overall similarity score is calculated additionally from    -   (v) an event count constraint violation score based on event        count violations by excessive occurrences of events of a certain        event type with respect to said event count constraint.

Further objects, features and benefits of the invention will becomeapparent from the appended claims and the following detailed descriptionof its preferred embodiments under reference to the enclosed drawings,wherein:

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1 and 2 show examples of a sample sequence of events and areference sequence of events, respectively;

FIG. 3 shows the steps of picking candidate combinations from the samplesequence, putting them into a tree graph, and calculating eventoccurrence scores as accumulated edge weights of the branches of thetree graph on the basis of counts of intervening events;

FIG. 4 shows the steps of calculating event occurrence scores asaccumulated edge weights of the branches of the tree graph on the basisof both, counts of intervening events and occurrence time deviations;

FIG. 5 shows the steps of calculating overall similarity scores for acandidate combination in the tree graph by accumulating the edge weightsand node weights, representing event occurrence score and attributematch score, respectively, in the tree graph;

FIGS. 6, 7, 8 and 9 are examples of the use of an Euclidian distancecalculation, a normalized sequence similarity calculation, and anattribute value series for normalized relative sequence similaritycalculation, respectively, for calculating attribute match scores;

FIGS. 10, 11, 12, and 13 are examples of the use of constraints in thematching steps, i.e. of an event occurrence constraint (FIG. 10), anevent order constraint (FIG. 11), an occurrence time constraint (FIG.12), and the concept of constraint nesting (FIG. 13), respectively; and

FIG. 14 shows the use of wildcard events in the reference sequence.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Preferred embodiment of the invention will be disclosed in this sectionby means of an incremental example structured in the following way:

-   1. matching of event type occurrence,-   2. matching of event occurrence time,-   3. matching of event attributes,-   4. processing of constraints set in the reference sequence,-   5. processing of arbitrary events added to the reference sequence,-   6. weighting of similarity factors, and-   7. distance calculation and overall similarity assessment.    In the context of the example, an event is a data packet of any    format, having an assigned event type and holding a set of    attributes. Each attribute is of a given data type and holds a    value. The term event sequence refers to a set of correlated events.    An apparatus for correlating temporally or semantically related    events is used to group single events into correlated event    sequences.

The method compares a sample sequence (searched event sequence) to areference sequence (search sequence). FIG. 1 illustrates a sample eventsequence. The sequence contains a set of events of types A, B, C and D,each holding an arbitrary number of event attributes.

An example of a reference sequence is given in FIG. 2. Event types inthe reference sequence are assumed to be the same as in the searchedevent sequences if they do have the same identifier. It is not requiredthat the numbers of distinct event types in the reference sequence andthe searched sequence match.

1. Matching of Event Type Occurrence

Event type occurrence similarity can be determined either in the senseof full event sequence matching or subsequence searching. The matchingprocess is the same in both cases. Yet, deviations at the beginning orend of the sequence are not considered in case of subsequence searching.

The process for event type occurrence matching is illustrated in FIG. 3.First, possible matches of the sequences are discovered by searching forevent occurrences of the event types in the reference sequence (FIG. 3a) and forming possible combinations of these event occurrences thatmatch the reference sequence in a tree graph. In FIG. 3 b this step isillustrated according to an example of a tree graph that shows a subsetof possible matches, also called “candidate combinations”, as branchesof the tree (only the first branch, i.e. only one of the candidatecombinations, is fully depicted in FIGS. 3-5; the other branches, orcandidate combinations, respectively, are shown only in part). Themethod also takes into consideration that certain event types may bemissing in the searched sequence by allowing the candidate matches tocontain “null-nodes” representing events that would have to be insertedinto the searched sequence.

Deviation Assessment for Subsequence Searching

Deviations are assigned between the occurrences of two events bydetermining the number (count) of events contained in the searchedsequence between the two events (FIG. 3 c). An arbitrary formula can beused for calculation of the deviation.

Deviation Assessment for Full Event Sequence Matching

In case of full event sequence matching, the occurrence of eventsbetween the start node and the first event in the candidate match areconsidered as deviations as well. In addition, also occurrences ofevents after the last event of the candidate match are considered asdeviations from the reference sequence (FIG. 3 d).

Evaluation of candidate combinations (matches) is based on the edge andnode costs along their branch in the tree graph. Edge costs result fromevents occurring in wrong order—below it is described that occurrencetime deviations may also be added to the edge costs or the node costs.Attribute similarity deviations also increase node costs. In addition,constraints (see below) can be taken into consideration for costassessment. An optional threshold level is introduced to stop candidatematching calculation for a certain candidate and continue with the nextone if deviations exceed the threshold (or fall under the threshold,respectively, depending on the definition of the scores and threshold).

2. Matching of Event Occurrence Times

After or during performing the event type matching, event occurrencetimes can optionally be taken into consideration for similarityassessment, see FIG. 4.

Sequentially, for each event in the reference sequence and thecorresponding event in the candidate combination the occurrence timesare compared. Deviations can be assessed based on the absolute values ofthe occurrence time or relative to a reference value (e.g. total eventsequence time-span).

Time deviations can be added to edge or node costs in the candidatecombination tree branch (FIG. 4 b).

3. Matching of Event Attributes

Event attribute matching means the process by which attribute values ofa set of attributes in the reference sequence's events are compared tothe corresponding attribute data in the candidate combination's events.

Having discovered a candidate combination, attribute value series in thereference sequence and the candidate combination sequence can becompared by applying one or more of the following techniques:

Attribute data type Similarity technique Numeric Euclidian distancesimilarity Normalized sequence similarity Normalized relative sequencesimilarity Semantic similarity String String distance metric similaritySemantic similarity Lookup table similarity Unknown Generic similarityimplementation

As illustrated in FIG. 5, attribute similarity deviations can be addedto node costs in the tree of candidate combinations to assess theoverall similarity score of a specific candidate combination.

Euclidian Distance Similarity

The Euclidian distance similarity technique can be applied to numericevent attributes and any kind of date formats. Hereby, a minimum and amaximum reference value are used and similarity is calculated relativelyto these values.

In FIG. 6, four events of the same event type are illustrated, eachhaving the same event attribute A1 of type integer. In the example, theminimum and maximum values among the events are used as referencevalues. Similarity is then calculated based on the Euclidian distancebetween two attribute values. For example, similarity of event 1 andevent 2 with respect to attribute A1 and similarity technique Euclidiandistance is:S(e1, e2, attr)=1−(|e1.attr−e2.attr|/(Rmax−Rmin)) S(Event1, Event2,A1)=1−(|22−12|/(109−12))=1−10/97 ≈0.897

with

-   -   S . . . attribute similarity    -   Rmin . . . reference interval minimum value    -   Rmax . . . reference interval maximum value        Normalized Sequence Similarity

The normalized sequence similarity technique is used for normalizingattribute values prior to assessing similarity. Normalization isperformed relatively to any reference value. For instance, the firstvalue of a sequence of values may be used as a reference. In FIG. 7 twoevent sequences are given. The sequences of values are shown before andafter normalization. The normalized values can then be compared to eachother with any similarity matching algorithm.

Normalized Relative Sequence Similarity

The normalized relative sequence similarity technique considers therelative distance between subsequent values in a value series. Anexample is given in FIG. 8.

In the example, the normalized sequence similarity technique is appliedto the distances between the values instead of applying it to the valuesitself. In this way, the two value series shown in FIG. 8 are consideredas being similar to each other.

Semantic Similarity

Depending on the application domain, any semantic similarity comparercan be provided to assess the similarity between two attributes ofarbitrary data type.

String Distance Metric Similarity

For string data attributes, the string distance metric similaritytechnique utilizes string metrics, a class of textual based metricsresulting in a similarity or dissimilarity score between two pairs ofstrings for approximate comparison and fuzzy searching. Any kind ofstring metric can be applied to compare strings for phonetic or literalsimilarities. Examples of string metrics are Hamming distance,Levensthein distance and Jaro-Winkler string metric.

Lookup Table Similarity

Lookup table similarity is applicable for numeric data attributes andstrings. Hereby, a lookup table is provided containing a set of valuepairs and a similarity score for each value pair. Similarity is thenassessed by looking up the values to be compared in the lookup table.

4. Processing of Constraints Set in the Reference Sequence

In addition to the above described techniques for similarity matching,constraints can be set in the reference sequence. These constraintseither limit the tolerance level of a similarity comparison, or can beset to weaken or underweight certain aspects in the comparison process.

Attribute Constraints

Attribute constraints are set for single event attributes in thereference sequence. Constraints can either be blocking, meaning that aviolation of a constraint means that the compared sequences areconsidered as unequal, or a constraint violation can only decrease thesimilarity score by a certain factor.

In FIG. 9 an example of a numeric attribute constraint is given.Attribute constraints can be set for numeric values and stringattributes, limiting the set of allowed attribute values to a givenrange or a list of allowed values.

Event Occurrence Constraints

Event occurrence constraints can be set for single events in thereference sequence or for sets of subsequent events.

In FIG. 10 examples of occurrence constraints are provided: A singleoccurrence constraint ranging from a minimum (min) to a maximum (max)number of occurrences means that at the given position in the referencesequence, between min and max events of the same event type may occur inthe searched sequence, otherwise a constraint violation is given. Agroup occurrence constraint means that between min and max subsequencesof events in the group may occur at the given position in the referencesequence. Event occurrence constraints can either be blocking, meaningthat a violation of a constraint means that the compared sequences areconsidered as unequal, or a constraint violation can only decrease thesimilarity score by a certain factor.

Order Constraints

Order constraints can be set for groups of subsequent events. In FIG. 11two types of order constraints are illustrated: A strict orderconstraint guarantees that the events within the group occur exactly inthe given order. If an arbitrary order block is inserted in thereference sequence, order deviations do not decrease the similarityscore.

Occurrence Time Constraints

Occurrence time constraints can be set to constrain the relative eventoccurrence time of single events within an event sequence (FIG. 12 a),the absolute occurrence time of single events ((FIG. 12 b) or the timespan between events in the event sequence (FIG. 12 c). All of theseconstraint types can also be set for groups of events.

Constraint Nesting

All constraints (attribute constraints, event occurrence constraints andorder constraints) can be combined and nested, meaning that for instancea strict order constraint can be nested within an event occurrenceconstraint. The nesting hierarchy is not limited, see FIG. 13. Inaddition, constraints can be overlapping.

5. Processing of Wildcard Events in the Reference Sequence

In the reference sequence, a set of arbitrary or “wildcard” events canbe inserted. Wildcard events mean that in the searched sequence, at thisposition any event may occur without decreasing the similarity score,see FIG. 14.

Event occurrence constraints and order constraints can be set forwildcard events in the same way as for normal events in the referencesequence.

6. Weighting of Similarity Scores

For sequence matching, all scores which can be considered for thecomparison can optionally be weighted by some factor. Weights may beassigned to:

-   -   each event type in order to weight event type occurrence        deviations;    -   each attribute in order to weight the result of attribute        comparisons according to the above listed techniques;    -   attribute constraints to weight constraint violations;    -   event occurrence constraints to weight violations of single        occurrence or group occurrence constraints;    -   order constraints;    -   occurrence time constraints;    -   arbitrary events in order to weight the fact that some arbitrary        event occurs in the searched event sequence;    -   single events in the reference sequence to weight their        occurrence; and    -   single attributes of events in the reference sequence to weight        their similarity to the corresponding attribute value in a        potential match.        7. Overall Similarity Score Assessment

The overall similarity score is then accumulated from one or more of thefollowing similarity scores:

-   -   Event occurrence score, based on intervening event counts        (either with full sequence matching or subsequence matching)        and/or occurrence time deviations; all optionally weighted by        single event occurrence weights and/or event type weights;    -   Attribute match score, e.g. in the form of the attribute        comparison similarity scores, optionally weighted by overall        attribute weights and/or single attribute weights;    -   Attribute constraint violation scores, optionally weighted by        constraint weights;    -   Event occurrence constraint violation scores, optionally        weighted by constraint weights;    -   Occurrence time constraint violation scores, optionally weighted        by constraint weights;    -   Order constraint violation scores, optionally weighted by        constraint weights;    -   Wildcard event insert scores, optionally weighted by wildcard        events weights.        In particular, as has been described above, preferred        embodiments thus comprise one or more of the following features:    -   time constraints in the reference sequence can restrict the        occurrence time of a set of events in the sample sequence;    -   arrangement constraints in the reference sequence can restrict        the order of a set of events or multiple sets of events in the        sample sequence;    -   arrangement constraints in the reference sequence can weaken the        weight of event order deviations for the assessment of the        overall similarity score;    -   event count constraints in the reference sequence can restrict        the number of occurrences of events of a certain event type at        one or multiple positions within the sample sequence;    -   time constraints in the reference sequence can restrict the time        window in which a set of events may occur in the event sequence;    -   at arbitrary positions in the reference sequence events of        unknown (wildcard) type can be inserted;    -   the reference sequence can be searched as a sub-sequence in the        sample sequence;    -   the applied scoring techniques can be assigned with different        weighting factors in the accumulated overall similarity score;    -   attributes of the events in the reference sequence can be        compared to attributes of the events in the sample sequence        using one or more of the following comparison techniques:        -   a) comparing numeric and date values to each other;        -   b) calculating the distance between string data attributes;        -   c) comparing data attributes holding data collections value            by value to each other;        -   d) comparing events nested in event attributes by comparing            their attributes;    -   the comparison of numeric and date values can use an arbitrary        algorithm;    -   the comparison of numeric and date values can be done relative        to arbitrary minimum and maximum reference values;    -   the distance calculation between string data can be based on an        arbitrary algorithm;    -   the attributes can be assigned with a weighting factor in the        accumulated overall similarity score;    -   different similarity techniques can be chosen independently for        each attribute of an event;    -   the matching of the sample sequence against the reference        sequence can use an arbitrary algorithm;    -   similarity techniques for matching the sample sequence against        the reference sequence can take into account one or more of the        following items:        -   a) occurrence of events of certain event type;        -   b) time of event occurrence and time span between the            occurrence of two or more events;        -   c) arrangement of events;        -   d) attribute values of events;        -   e) violation or fulfilment of constraints set in the            reference pattern as described above;    -   events can be available in binary format;    -   events can be available in XML format;    -   the sample sequence can be represented as a time series of        numeric or discrete values at given points in time;    -   separate time series can exist for one or more series of event        attribute values;    -   the reference sequence detected can be used to forecast future        events;    -   the reference sequence detected can be used to forecast future        effects of an event sequence;    -   the reference sequence detected can be used to forecast future        key figures of an event sequence; and/or    -   the calculated distance between the sample sequence and a        reference sequence can be mapped to visual dimensions in a        visualization.        The invention is thus not restricted to the specific embodiments        and examples disclosed herein but encompasses all variants and        modifications thereof falling in the scope and spirit of the        appended claims.

1. A method of detecting a reference sequence of events in a samplesequence of events, wherein each event is of a certain event type andholds a set of data attributes, the method comprising: (a) pickingcandidate combinations of events from said sample sequence so that theevent types within each candidate combination match the event types inthe reference sequence; (b) calculating an overall similarity score foreach candidate combination from at least (i) an event occurrence scorebased on occurrence deviations representing a count of non-matchingevents between the events of a candidate combination matching events ofthe reference sequence, and (ii) an attribute match score based onsimilarity deviations between the data attributes of the events of acandidate combination and the data attributes of the matching events ofthe reference sequence; and (c) identifying the candidate combinationwith the best overall similarity score as reference sequence detected;wherein the events of the candidate combinations picked from the samplesequence are put as nodes into a tree graph, each candidate combinationforming a branch of the tree graph consisting of nodes connected viaedges; wherein occurrence deviations are attributed as weights to saidedges and similarity deviations as weights to said nodes; and whereinthe overall similarity score of each candidate combination is calculatedas a total weight accumulated along the branch formed by each candidatecombination.
 2. The method of claim 1, wherein the calculation of theoverall similarity score is made as a weighted sum of at least the eventoccurrence score and the attribute match score.
 3. The method of claim1, wherein the event occurrence score is further calculated fromdeviations of actual occurrence times of the events of the candidatecombination with respect to expected occurrence times defined in thereference sequence.
 4. The method of claim 1, wherein calculating theoverall similarity score for a specific candidate combination is notpursued further when the overall similarity score passes a giventhreshold during said calculating.
 5. The method of claim 1, whereinattribute match scores are determined only for those candidatecombinations for which the event occurrence scores do not pass a giventhreshold during the determining of the event occurrence scores.
 6. Themethod of claim 1, wherein calculating the overall similarity score fora specific candidate combination is not pursued further when saidoverall similarity score passes a given threshold.
 7. The method ofclaim 1, wherein similarity deviations are calculated only for thosecandidate combinations for which occurrence deviation weights do notexceed a given threshold.
 8. The method of claim 1, wherein similaritydeviations of said data attributes are calculated by comparing numericor date values relative to each other or relative to given referencevalues.
 9. The method of claim 1, wherein similarity deviations of saiddata attributes are calculated by comparing distances of string dataattributes relative to each other or relative to given reference values.10. The method of claim 1, wherein the reference sequence comprises timeconstraints, and wherein said overall similarity score is calculatedadditionally from (iii) a time constraint violation score based on timeconstraint violations of the events of a candidate combination withrespect to said time constraints.
 11. The method of claim 9, wherein atleast one time constraint is a time window for events to occur in ordernot to violate said time constraint.
 12. The method of claim 1, whereinthe reference sequence comprises arrangement constraints, and whereinsaid overall similarity score is calculated additionally from (iv) anarrangement constraint violation score based on arrangement constraintviolations due to the order of events in a candidate combination withrespect to said arrangement constraint.
 13. The method of claim 12,wherein at least one arrangement constraint can weaken the weight of theevent occurrence score in the overall similarity score.
 14. The methodof claim 1, wherein event count constraints are set in the referencesequence, and wherein said overall similarity score is calculatedadditionally from (v) an event count constraint violation score based onevent count violations by excessive occurrences of events of a certainevent type with respect to said event count constraint.
 15. The methodof claim 1, wherein the reference sequence comprises a wildcard eventwhich can be matched by any event of a candidate combination.
 16. Themethod of claim 1, wherein the events of the sample sequence arecorrelated.
 17. The method of claim 1, wherein at least some of theevents are nested.